---
title: "Joomla JCE CVE-2026-48907: Exploited Profile Import RCE"
url: https://erroneo.us/security/briefs/jce-joomla-cve-2026-48907-profile-import-rce/
description: "Unauthenticated profile import in the JCE editor for Joomla before 2.9.99.5 leads to PHP upload and RCE; mass-exploited, in KEV. Update and hunt rogue profiles."
type: security-brief
section: "Security Digest"
date_published: 2026-06-03
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-48907"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Joomla JCE CVE-2026-48907: Exploited Profile Import RCE

**Verdict: Act now.** Any Joomla site still on JCE 2.9.99.4 or older should be updated today and treated as compromised, because automated attacks with public exploit code have planted web shells through it since June.

- **Who must act:** Owners, agencies and hosts of Joomla sites running JCE Core or Pro at 2.9.99.4 or older, and anyone who updated after early June 2026 without checking for rogue editor profiles and web shells.
- **Who can relax:** Joomla sites without JCE, and sites that updated to 2.9.99.5 or later in early June and have since found no unknown editor profiles or PHP files.
- **Affected:** JCE (Core and Pro) 1.0.0 through 2.9.99.4, per the CVE record; Joomla 3, 4, 5 and 6 sites running those versions
- **Fixed:** JCE 2.9.99.5 (June 3, 2026); JCE 2.9.99.6 (June 8, 2026), a hardening release recommended as the minimum by mySites.guru and Beazley; Current releases 2.9.99.12 and 3.0.2 (Oct 7, 2026); Vendor's free stopgap patch for JCE 2.7.x, 2.8.x and 2.9.x
- **CVEs:** CVE-2026-48907
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the JCE version on every Joomla site, including staging copies and client sites you host.
2. Update to the current JCE release (2.9.99.12 or 3.0.2 as of Oct 23, 2026); if you cannot, apply the vendor's free patch or uninstall JCE.
3. Open Components: JCE Editor: Editor Profiles and delete any profile you did not create; check permitted file extensions for php, phtml or txt.
4. Remove web shells, or restore from a backup taken before the first unauthenticated profiles.import request in your logs.
5. Rotate Joomla administrator passwords, the database password in configuration.php and any other stored secrets.
6. Block unauthenticated requests to option=com_jce&task=profiles.import at the WAF as an extra layer.

### How to check if you are affected

- Search access logs for unauthenticated POSTs to option=com_jce&task=profiles.import, especially followed by a POST with method=upload, both returning 200.
- Look for editor profiles with machine-generated names such as J940401, labels like Pwned or RCE via JCE, or an ordering of -99999.
- Find .xml.php droppers, eval(gzinflate(base64_decode( blobs and Nxploited marker files under images, media, tmp and libraries.
- Review the Super Users group for administrators nobody on your team created.

## What happened

On June 3, 2026, Widget Factory released 2.9.99.5 of JCE, its content editor extension for Joomla. Its [changelog](https://www.joomlacontenteditor.net/support/changelog/editor) lists CVE-2026-48907: "Insufficient access controls permitted unauthenticated users to upload editor profiles." The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-48907), published June 5 by Joomla's CNA, says this ends in "PHP code upload and execution." It scores CVSS 4.0 10.0. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-48907) rates it 9.8 on CVSS 3.1.

The entry point is the profile import task, `index.php?option=com_jce&task=profiles.import`, which answered without a login. Per [mySites.guru](https://mysites.guru/jce-hack/), attackers "Import a rogue profile that re-enables `php` and `txt` uploads with MIME validation switched off," then upload a web shell through it. mySites.guru says working exploit code went public on GitHub on June 9. The vendor's [June 12 advisory](https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites) says "the attacks are automated" and warns that a site "with no public registration is not safe." CISA added the bug to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907) on June 16, due June 19.

## Who is affected

The CVE record lists JCE 1.0.0 through 2.9.99.4. [mySites.guru](https://mysites.guru/vulnerabilities/CVE-2026-48907/) says JCE Core and Pro are both affected on Joomla 3, 4, 5 and 6. The vendor says 2.6.x "does not appear to be affected in a default configuration," though this is unverified. Version 2.9.99.6 (June 8) added hardening, and [Beazley Security](https://labs.beazley.security/advisories/BSL-A1181) and mySites.guru treat it as the minimum. The current releases are 2.9.99.12 and [3.0.2](https://www.joomlacontenteditor.net/support/changelog/editor/30x), both from October 7, 2026. For sites that cannot update, the vendor offers a free stopgap patch for JCE 2.7.x, 2.8.x and 2.9.x. It lacks later hardening and cleans nothing.

JCE was the first of five Joomla extensions CISA added to KEV this summer; SP Page Builder, Page Builder CK, iCagenda and Balbooa Forms followed in July. No source reviewed ties them to one campaign.

## Do you really need to act?

Yes, if any site you run is on 2.9.99.4 or older. The bug needs no account and no special setup, and the vendor says the attacks are automated. As [The Hacker News](https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.html) reported, updating "closes the entry point but does not clean a site that was already compromised." mySites.guru says that once a shell is in place, attackers can add super administrators, change files and download the database. If a site ran a vulnerable version after early June, assume it was hit until checked.

## What to do now

1. Check the installed JCE version on every site (Extensions: Manage).
2. Update to 2.9.99.12 or 3.0.2. If you cannot, apply the vendor's patch or uninstall JCE.
3. Open Components, JCE Editor, Editor Profiles. Delete profiles you did not create, and check the permitted file extensions in Image Manager and File Browser for `php`, `phtml` or `txt`.
4. Remove web shells, or restore from a backup taken before the first malicious import request.
5. Rotate admin passwords, the database password in `configuration.php` and any API keys the site stores.

## How to tell if you were hit

Run `grep -E 'com_jce.*task=profiles\.import' access.log*`. mySites.guru describes the attack as an unauthenticated import POST followed by a `method=upload` POST, both returning 200, "often carrying an id=RCExxx marker." The vendor says the earliest match shows when the site was first reached. Look for profiles with generated names such as `J940401`, labels like "Pwned" or "RCE via JCE," or an ordering of `-99999`. On disk, run `find images media tmp libraries -name '*.php*' -newermt 2026-06-01` and `grep -rl 'gzinflate(base64_decode' images media tmp libraries`. Hidden `.xml.php` droppers and "Nxploited" marker files are also signs. Check the Super Users group for unknown administrators.

## Timeline

- Jun 3, 2026 — JCE 2.9.99.5 fixes CVE-2026-48907.
- Jun 5, 2026 — The CVE is published (CVSS 4.0 10.0).
- Jun 9, 2026 — Working exploit code appears on GitHub, per mySites.guru.
- Jun 12, 2026 — The vendor publishes its advisory and a free patch for older versions.
- Jun 16, 2026 — CISA adds the CVE to KEV, due June 19.
- Oct 7, 2026 — JCE 2.9.99.12 and 3.0.2, the current releases, ship.

## Sources

1. [JCE (Widget Factory) — JCE Security Update and a Free Patch for Older Sites](https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites)
2. [JCE — Editor changelog 2.x](https://www.joomlacontenteditor.net/support/changelog/editor)
3. [JCE — Editor changelog 3.0.x](https://www.joomlacontenteditor.net/support/changelog/editor/30x)
4. [CVE record — CVE-2026-48907](https://www.cve.org/CVERecord?id=CVE-2026-48907)
5. [NVD — CVE-2026-48907](https://nvd.nist.gov/vuln/detail/CVE-2026-48907)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-48907](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907)
7. [mySites.guru — The JCE hack: rogue profiles and web shells](https://mysites.guru/jce-hack/)
8. [mySites.guru — CVE-2026-48907](https://mysites.guru/vulnerabilities/CVE-2026-48907/)
9. [Beazley Security Labs — BSL-A1181: Critical Vulnerability in Content Editor Extension for Joomla (CVE-2026-48907)](https://labs.beazley.security/advisories/BSL-A1181)
10. [Falcon Internet — Joomla JCE CVE-2026-48907: unauthenticated RCE and web shells](https://falconinternet.net/blog/joomla-jce-cve-2026-48907-unauthenticated-rce-web-shell)
11. [The Hacker News — CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution](https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.html)

---
Source page: https://erroneo.us/security/briefs/jce-joomla-cve-2026-48907-profile-import-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt